CVE-2026-57510 Details

A broken object-level authorization vulnerability has been identified in SuperPlane versions prior to 0.27.0. This vulnerability allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations. The issue arises in the CanvasService gRPC handlers, where users can supply arbitrary canvas or queue UUIDs without organization scoping. Exploitation of this vulnerability enables attackers to read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

Users can update to SuperPlane version 0.27.0 or later, where this vulnerability has been addressed.